9efd6360ad82b8088266f0820a27792f381dc0226fd6472309838ba07c7c3739

Analysis

max time kernel
39s
max time network
47s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 18:05

Target

9efd6360ad82b8088266f0820a27792f381dc0226fd6472309838ba07c7c3739.exe
Size

406KB
MD5

828d5fe7caef131c3395514450783b88
SHA1

0b1ca3cfa7df2ccb2b600c9701b6366d046effec
SHA256

9efd6360ad82b8088266f0820a27792f381dc0226fd6472309838ba07c7c3739
SHA512

280c8d7a54d20b0b136973f11f03150c7cb605054eac8b95d14bfb5a43ca5e2fd9addf5660f32277de19f3fa71f58986f0d6bfd68252887ce2588681d5391b89
SSDEEP

3072:lAK3KloQSrkKgRENEI5apGTwQqVMAb0v+tI+18xErMsIl0YIPE/BwtKDQIFHc1kA:ldGrMse1y3GQ0HkR6txgn/LcWq2KkNNb

Score

5^/10

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1736 set thread context of 1116	1736	9efd6360ad82b8088266f0820a27792f381dc0226fd6472309838ba07c7c3739.exe	29

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1736	9efd6360ad82b8088266f0820a27792f381dc0226fd6472309838ba07c7c3739.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1116	1736	9efd6360ad82b8088266f0820a27792f381dc0226fd6472309838ba07c7c3739.exe	29
PID 1736 wrote to memory of 1116	1736	9efd6360ad82b8088266f0820a27792f381dc0226fd6472309838ba07c7c3739.exe	29
PID 1736 wrote to memory of 1116	1736	9efd6360ad82b8088266f0820a27792f381dc0226fd6472309838ba07c7c3739.exe	29
PID 1736 wrote to memory of 1116	1736	9efd6360ad82b8088266f0820a27792f381dc0226fd6472309838ba07c7c3739.exe	29
PID 1736 wrote to memory of 1116	1736	9efd6360ad82b8088266f0820a27792f381dc0226fd6472309838ba07c7c3739.exe	29
PID 1736 wrote to memory of 1116	1736	9efd6360ad82b8088266f0820a27792f381dc0226fd6472309838ba07c7c3739.exe	29
PID 1736 wrote to memory of 1116	1736	9efd6360ad82b8088266f0820a27792f381dc0226fd6472309838ba07c7c3739.exe	29
PID 1736 wrote to memory of 1116	1736	9efd6360ad82b8088266f0820a27792f381dc0226fd6472309838ba07c7c3739.exe	29

C:\Users\Admin\AppData\Local\Temp\9efd6360ad82b8088266f0820a27792f381dc0226fd6472309838ba07c7c3739.exe
"C:\Users\Admin\AppData\Local\Temp\9efd6360ad82b8088266f0820a27792f381dc0226fd6472309838ba07c7c3739.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Users\Admin\AppData\Local\Temp\9efd6360ad82b8088266f0820a27792f381dc0226fd6472309838ba07c7c3739.exe
  "C:\Users\Admin\AppData\Local\Temp\9efd6360ad82b8088266f0820a27792f381dc0226fd6472309838ba07c7c3739.exe"
  2⤵
  PID:1116

memory/1116-57-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1116-58-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1116-60-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1116-61-0x0000000000400000-0x0000000000409000-memory.dmp

Filesize
36KB

Download
memory/1116-65-0x0000000000400000-0x00000000004083A0-memory.dmp

Filesize
32KB

Download
memory/1116-66-0x0000000075DA1000-0x0000000075DA3000-memory.dmp

Filesize
8KB

Download
memory/1116-67-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/1736-56-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/1736-64-0x0000000002420000-0x0000000002469000-memory.dmp

Filesize
292KB

Download
memory/1736-68-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/1736-69-0x0000000002420000-0x0000000002469000-memory.dmp

Filesize
292KB

Download